dexbot 1.6.6 → 1.6.7

package/dist/modules/order/utils/system.d.ts

@@ -209,6 +209,103 @@ export declare function persistGridSnapshot(manager: any, accountOrders: any, sn
  * @returns {number} Number of streak entries restored
  */
 export declare function restoreGapEvacStreaks(manager: any, persisted: any): number;
+/**
+ * Normalize a persisted LAST-FILL-GUARD pivot row (shared by the
+ * AccountOrders sanitizer/loader and the payload builder's row contract).
+ *
+ * Returns the row normalized to {price:number, type, fillsAt:number,
+ * genesisHash} when every field passes its gate, null otherwise:
+ * - finite price > 0
+ * - type is ORDER_TYPES.BUY or ORDER_TYPES.SELL
+ * - finite fillsAt > 0
+ * - non-empty string genesisHash
+ *
+ * @param {any} row - Raw candidate row
+ * @returns {Object|null} Normalized row or null
+ */
+export declare function normalizeLastFillPivot(row: any): {
+    price: number;
+    type: string;
+    fillsAt: number;
+    genesisHash: string;
+} | null;
+/**
+ * Write the LAST-FILL-GUARD pivot scalar family in one place (free
+ * implementation shared by the manager method, cow_runtime's queued-fill
+ * refresh, and restoreLastFillPivot).
+ *
+ * Writes _lastFilledPrice, _lastFilledType, _lastFilledAt,
+ * lastFillPivotSource and the per-side mirror (_lastFilledBuyPrice or
+ * _lastFilledSellPrice). `atMs` lets restoreLastFillPivot preserve the
+ * persisted fill timestamp (otherwise every restart would re-stamp "now"
+ * and the TTL would degrade to "time since last restart"); ordinary fill
+ * calls omit it and take Date.now().
+ *
+ * @param {Object} manager - OrderManager instance (or legacy stub)
+ * @param {string} type - ORDER_TYPES.BUY or ORDER_TYPES.SELL
+ * @param {number} price - Pivot price (finite, > 0)
+ * @param {string} provenance - 'fill' (persist-eligible) or 'book' (seed heuristic)
+ * @param {number} [atMs] - Fill timestamp to preserve (defaults to now)
+ * @returns {boolean} True when the pivot was written
+ */
+export declare function setLastFillPivot(manager: any, type: any, price: any, provenance: 'fill' | 'book', atMs?: number): boolean;
+/**
+ * Clear the manager's LAST-FILL-GUARD pivot to cold state — the FULL scalar
+ * family, per-side mirrors included. Clearing only the primary fields would
+ * leave seedLastFilledPricesFromBook's early-return (both mirrors set)
+ * silently suppressing the startup book seed after every grid rebuild — the
+ * exact cold window the persist/restore feature exists to close.
+ *
+ * Used whenever the pivot's generation is invalidated: grid rebuild via
+ * initializeGrid, rejected snapshot reset, and any path that re-anchors the
+ * boundary outside the fill flow. The guard re-arms on the next real fill
+ * (or via the startup book seed), never against a boundary that no longer
+ * exists. Must not touch disk: the pivot is a live-grid invariant, and the
+ * persist pipeline clears the stored row on the next flush by passing null.
+ *
+ * @param {Object} manager - OrderManager instance
+ * @param {string} reason - Log/debug label
+ * @returns {boolean} True when an armed pivot was cleared
+ */
+export declare function resetLastFillPivot(manager: any, reason?: string): boolean;
+/**
+ * Restore the persisted LAST-FILL-GUARD pivot into the manager.
+ *
+ * MUST run with the boundary (after loadGrid has applied the persisted
+ * genesis + re-typed the grid, before the first reconcile/broadcast) so the
+ * guard is never armed against a geometry the snapshot does not describe.
+ *
+ * Validation chain (fail → no-op, never arm on a poisoned value):
+ * 1. Shape: normalizeLastFillPivot re-validates the row (shared gate).
+ * 2. TTL: a pivot older than GRID_LIMITS.LAST_FILL_PIVOT_TTL_MS expires
+ *    instead of vetoing legitimate placements after long downtime (the
+ *    pivot is a "latest fill" fact, not a permanent ratchet). Expired rows
+ *    are dead rows: the shared drop path (clearPersistedLastFillPivot
+ *    under the bot's persistence lock, best-effort) erases them so a later
+ *    validation failure cannot leave a half-invalid row armed.
+ * 3. Genesis binding: a row whose genesisHash differs from the manager's
+ *    current genesis belongs to a dead generation — dropped through the
+ *    same shared drop path (erased from disk so it cannot re-arm on the
+ *    next restart).
+ * 4. On-grid check reuses the runtime's own ladder validator
+ *    (resolveOnGridPivot in dexbot_cow_runtime, safe to import from here —
+ *    utils/system never imports it otherwise, so no cycle). One
+ *    implementation for both the live guard and the restore path, same
+ *    increment fallback chain. On success the snapped ladder level is
+ *    restored — the guard's own convention — never the raw persisted
+ *    float, and the ORIGINAL fillsAt is preserved through
+ *    setLastFillPivot's atMs so the TTL keeps meaning "age of the last
+ *    fill", not "time since this restart".
+ *
+ * @param {Object} manager - OrderManager instance
+ * @param {Object|null} persisted - {price, type, fillsAt, genesisHash} from loadLastFillPivot
+ * @param {Object} [options]
+ * @param {number} [options.now] - Injectable clock (tests)
+ * @returns {boolean} True when the guard was re-armed from the snapshot
+ */
+export declare function restoreLastFillPivot(manager: any, persisted: any, options?: {
+    now?: number;
+}): boolean;
 /**
  * Retry grid persistence if previous attempt failed.
  * Clears persistence warning flag if successful.

package/dist/modules/order/utils/system.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system.d.ts","sourceRoot":"","sources":["../../../../modules/order/utils/system.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAiBH,QAAA,MAAQ,SAAS;QAzCoC,CAAC;UAyCf,CAAC;AAiBxC;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,GAAU,WAAW,GAAG,EAAE,GAAG,MAAM,KAAG,OAAO,CAAC,GAAG,CAiCxE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAU,WAAW,GAAG,EAAE,KAAK,GAAG,KAAG,OAAO,CAAC,GAAG,CAsB7E,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAU,WAAW,GAAG,EAAE,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CA0CzG,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAAU,WAAW,GAAG,EAAE,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CA2IvG,CAAC;AAcD;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,GAAG,IAAI,KAAG,IAE7E,CAAC;AAEF,eAAO,MAAM,WAAW,GAAU,WAAW,GAAG,EAAE,MAAM,MAAM,EAAE,MAAM,MAAM,EAAE,OAAM,MAAe,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CA4B3H,CAAC;AAaF;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,EAA0B,EAAE,IAAI,GAAE,MAAe,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAqBxM;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,EAA0B,EAAE,IAAI,GAAE,MAAe,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CASzM;AAgFD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,6BAA6B,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,IAAI,GAAE,MAAe,EAAE,YAAY,GAAE,OAAe,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwErM;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAmCzD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAsCD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAmFxG;AAMD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAwEzN;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,CAc1E;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAW7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,kCAAkC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+UxP;AAOD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAGpE;AAED;;;GAGG;AACH,wBAAgB,MAAM,IAAI,MAAM,CAE/B;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAiHpN;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAkE;AAErI;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAalN;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACvC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IACN,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,GACF,OAAO,CAAC,CAAC,CAAC,CA4DZ;AAMD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW9E;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAYxC;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAGtD;AAED,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,2BAA2B,CAC7C,GAAG,EAAE,GAAG,EACR,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtF,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B5F"}
+{"version":3,"file":"system.d.ts","sourceRoot":"","sources":["../../../../modules/order/utils/system.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAiBH,QAAA,MAAQ,SAAS;QAzCoC,CAAC;UAyCf,CAAC;AAiDxC;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,GAAU,WAAW,GAAG,EAAE,GAAG,MAAM,KAAG,OAAO,CAAC,GAAG,CAiCxE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAU,WAAW,GAAG,EAAE,KAAK,GAAG,KAAG,OAAO,CAAC,GAAG,CAsB7E,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAU,WAAW,GAAG,EAAE,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CA0CzG,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAAU,WAAW,GAAG,EAAE,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CA2IvG,CAAC;AAcD;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,GAAG,IAAI,KAAG,IAE7E,CAAC;AAEF,eAAO,MAAM,WAAW,GAAU,WAAW,GAAG,EAAE,MAAM,MAAM,EAAE,MAAM,MAAM,EAAE,OAAM,MAAe,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CA4B3H,CAAC;AAaF;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,EAA0B,EAAE,IAAI,GAAE,MAAe,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAqBxM;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,EAA0B,EAAE,IAAI,GAAE,MAAe,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CASzM;AAgFD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,6BAA6B,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,IAAI,GAAE,MAAe,EAAE,YAAY,GAAE,OAAe,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwErM;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAmCzD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAsCD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAmFxG;AAMD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAgFzN;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,CAc1E;AAiCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW7H;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAazH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,GAAE,MAAsB,GAAG,OAAO,CAexF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAgE1G;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAW7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,kCAAkC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA+UxP;AAOD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAGpE;AAED;;;GAGG;AACH,wBAAgB,MAAM,IAAI,MAAM,CAE/B;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAiHpN;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAkE;AAErI;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAalN;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACvC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IACN,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,GACF,OAAO,CAAC,CAAC,CAAC,CA4DZ;AAMD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW9E;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAYxC;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAGtD;AAED,OAAO,EAAE,SAAS,EAAE,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,2BAA2B,CAC7C,GAAG,EAAE,GAAG,EACR,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtF,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B5F"}

package/dist/modules/order/utils/system.js

@@ -50,7 +50,7 @@ const require = createRequire(import.meta.url);
 import { path } from '../../path_api.js';
 import { getStorage } from '../../storage/index.js';
 const storage = getStorage();
-import { API_LIMITS, ORDER_TYPES, COW_ACTIONS, FEE_PARAMETERS, BTS_PRECISION, PIPELINE_TIMING, NATIVE_CLIENT } from '../../constants.js';
+import { API_LIMITS, ORDER_TYPES, COW_ACTIONS, FEE_PARAMETERS, BTS_PRECISION, PIPELINE_TIMING, NATIVE_CLIENT, GRID_LIMITS } from '../../constants.js';
 import { PATHS } from '../../paths.js';
 import { toFiniteNumber, isValidNumber } from '../format.js';
 import * as MathUtils from './math.js';
@@ -61,6 +61,39 @@ import { getErrorMessage } from '../../utils/errors.js';
 import { withTimeout } from './timeout.js';
 const { ensureDir, readJSON } = storage;
 const systemLogger = new Logger('System');
+/**
+ * Lazily-bound ladder validator: resolveOnGridPivot from the COW runtime,
+ * imported on first use (not at module top level). utils/system.ts Must not
+ * statically import dexbot_cow_runtime (the runtime is a startup-graph
+ * heavyweight and the static edge would pull the whole COW engine into
+ * everything that touches persistence helpers); the runtime CAN statically
+ * import utils/system (it already does), so this edge stays one-directional
+ * and cycle-free in practice.
+ *
+ * Shared on purpose (centralization): one ladder-validation implementation
+ * — the increment fallback chain (manager.config → DEFAULT_CONFIG) and the
+ * one-increment drift refusal — serves both the live guard's per-probe
+ * validation and the persisted-pivot restore. The restorer must never
+ * accept a pivot value the runtime would itself refuse per probe.
+ *
+ * @param {Object} manager - OrderManager instance
+ * @param {number} price - Candidate pivot price
+ * @returns {Object|null} {price, slotIdx, snapped, nearestDrift} or null
+ */
+function cowRuntimeLadderValidator(manager, price) {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        const { resolveOnGridPivot } = require('../../dexbot_cow_runtime');
+        const validated = resolveOnGridPivot(manager, price);
+        if (!validated || validated.price == null || validated.idx == null)
+            return null;
+        return { price: validated.price, slotIdx: validated.idx, snapped: !!validated.snapped, nearestDrift: validated.nearestDrift };
+    }
+    catch (e) {
+        systemLogger.warn(`restoreLastFillPivot: ladder validator unavailable (${getErrorMessage(e)})`);
+        return null;
+    }
+}
 function _debugLogAndNull(method, symA, symB) {
     return (err) => {
         // debug level: underlying derivePoolPrice/deriveMarketPrice already log at warn
@@ -856,12 +889,19 @@ export async function persistGridSnapshot(manager, accountOrders, snapshotOrders
                 .slice(-500)
                 .map((e) => ({ slotId: e.slotId, side: e.side, ts: Number(e.ts) }))
             : undefined;
+        // LAST-FILL-GUARD pivot (restart resilience): only a fill-provenanced
+        // pivot is eligible — a book-seeded heuristic is never persisted as if
+        // it were market truth. Every other case (book seed, cold manager,
+        // legacy stub without the flags) passes null, which storeMasterGrid
+        // treats as an explicit clear; the row carries the CURRENT live
+        // genesis hash so a restore that sees a re-derived genesis refuses it.
+        const lastFillPivot = buildLastFillPivotPayload(manager);
         await accountOrders.storeMasterGrid(orders, btsFeesOwed, manager.boundaryIdx, manager.assets || null, {
             persistedAt: nowIso(),
             config: debugConfig,
             accountTotals,
             btsBalance
-        }, fillKeys, genesis, gapEvacStreaks, pendingFillCrawls);
+        }, fillKeys, genesis, gapEvacStreaks, pendingFillCrawls, lastFillPivot);
         return true;
     }
     catch (e) {
@@ -897,6 +937,238 @@ export function restoreGapEvacStreaks(manager, persisted) {
     manager._gapEvacStreaks = streaks;
     return streaks.size;
 }
+/**
+ * Build the persist payload for the LAST-FILL-GUARD pivot, or null when there
+ * is nothing durable to write.
+ *
+ * Source-of-truth contract (single ledger): the manager's in-memory pivot is
+ * authoritative during runtime; the disk row is a mirror that follows the
+ * grid snapshot, so it invalidates whenever the snapshot does:
+ * - Only a 'fill'-provenance pivot is eligible — a book-seeded pivot is a
+ *   heuristic, not market truth, and must not fossilize into the snapshot.
+ * - The row carries the CURRENT live genesis hash, so a restore that sees a
+ *   different (re-derived/regenerated) genesis refuses it (a pivot from an
+ *   old generation is not valid after a grid regeneration).
+ * - A pivot without a live genesis is not persistable: null always clears,
+ *   so an expired generation never leaves a stale row behind on disk.
+ *
+ * @param {Object} manager - OrderManager instance
+ * @returns {Object|null} {price, type, fillsAt, genesisHash} or null to clear
+ */
+function buildLastFillPivotPayload(manager) {
+    const price = Number(manager?._lastFilledPrice);
+    const type = manager?._lastFilledType;
+    if (manager?.lastFillPivotSource !== 'fill')
+        return null;
+    if (!Number.isFinite(price) || price <= 0)
+        return null;
+    if (type !== ORDER_TYPES.BUY && type !== ORDER_TYPES.SELL)
+        return null;
+    const fillsAt = Number(manager._lastFilledAt);
+    if (!Number.isFinite(fillsAt))
+        return null;
+    const genesisHash = manager?._genesis?.priceLevelsHash;
+    if (typeof genesisHash !== 'string' || genesisHash.length === 0)
+        return null;
+    return { price, type, fillsAt, genesisHash };
+}
+/**
+ * Normalize a persisted LAST-FILL-GUARD pivot row (shared by the
+ * AccountOrders sanitizer/loader and the payload builder's row contract).
+ *
+ * Returns the row normalized to {price:number, type, fillsAt:number,
+ * genesisHash} when every field passes its gate, null otherwise:
+ * - finite price > 0
+ * - type is ORDER_TYPES.BUY or ORDER_TYPES.SELL
+ * - finite fillsAt > 0
+ * - non-empty string genesisHash
+ *
+ * @param {any} row - Raw candidate row
+ * @returns {Object|null} Normalized row or null
+ */
+export function normalizeLastFillPivot(row) {
+    if (!row || typeof row !== 'object')
+        return null;
+    const price = Number(row.price);
+    const type = row.type;
+    const fillsAt = Number(row.fillsAt);
+    const genesisHash = row.genesisHash;
+    if (!Number.isFinite(price) || price <= 0)
+        return null;
+    if (type !== ORDER_TYPES.BUY && type !== ORDER_TYPES.SELL)
+        return null;
+    if (!Number.isFinite(fillsAt) || fillsAt <= 0)
+        return null;
+    if (typeof genesisHash !== 'string' || genesisHash.length === 0)
+        return null;
+    return { price, type, fillsAt, genesisHash };
+}
+/**
+ * Write the LAST-FILL-GUARD pivot scalar family in one place (free
+ * implementation shared by the manager method, cow_runtime's queued-fill
+ * refresh, and restoreLastFillPivot).
+ *
+ * Writes _lastFilledPrice, _lastFilledType, _lastFilledAt,
+ * lastFillPivotSource and the per-side mirror (_lastFilledBuyPrice or
+ * _lastFilledSellPrice). `atMs` lets restoreLastFillPivot preserve the
+ * persisted fill timestamp (otherwise every restart would re-stamp "now"
+ * and the TTL would degrade to "time since last restart"); ordinary fill
+ * calls omit it and take Date.now().
+ *
+ * @param {Object} manager - OrderManager instance (or legacy stub)
+ * @param {string} type - ORDER_TYPES.BUY or ORDER_TYPES.SELL
+ * @param {number} price - Pivot price (finite, > 0)
+ * @param {string} provenance - 'fill' (persist-eligible) or 'book' (seed heuristic)
+ * @param {number} [atMs] - Fill timestamp to preserve (defaults to now)
+ * @returns {boolean} True when the pivot was written
+ */
+export function setLastFillPivot(manager, type, price, provenance, atMs) {
+    if (!manager)
+        return false;
+    if (type !== ORDER_TYPES.BUY && type !== ORDER_TYPES.SELL)
+        return false;
+    const p = Number(price);
+    if (!Number.isFinite(p) || p <= 0)
+        return false;
+    const now = Number.isFinite(Number(atMs)) && Number(atMs) > 0 ? Number(atMs) : Date.now();
+    manager._lastFilledPrice = p;
+    manager._lastFilledType = type;
+    manager._lastFilledAt = now;
+    manager.lastFillPivotSource = provenance;
+    if (type === ORDER_TYPES.BUY)
+        manager._lastFilledBuyPrice = p;
+    else
+        manager._lastFilledSellPrice = p;
+    return true;
+}
+/**
+ * Clear the manager's LAST-FILL-GUARD pivot to cold state — the FULL scalar
+ * family, per-side mirrors included. Clearing only the primary fields would
+ * leave seedLastFilledPricesFromBook's early-return (both mirrors set)
+ * silently suppressing the startup book seed after every grid rebuild — the
+ * exact cold window the persist/restore feature exists to close.
+ *
+ * Used whenever the pivot's generation is invalidated: grid rebuild via
+ * initializeGrid, rejected snapshot reset, and any path that re-anchors the
+ * boundary outside the fill flow. The guard re-arms on the next real fill
+ * (or via the startup book seed), never against a boundary that no longer
+ * exists. Must not touch disk: the pivot is a live-grid invariant, and the
+ * persist pipeline clears the stored row on the next flush by passing null.
+ *
+ * @param {Object} manager - OrderManager instance
+ * @param {string} reason - Log/debug label
+ * @returns {boolean} True when an armed pivot was cleared
+ */
+export function resetLastFillPivot(manager, reason = 'unspecified') {
+    if (!manager)
+        return false;
+    const wasArmed = manager._lastFilledPrice != null && manager._lastFilledType != null;
+    manager._lastFilledPrice = null;
+    manager._lastFilledType = null;
+    manager._lastFilledAt = 0;
+    manager.lastFillPivotSource = null;
+    manager._lastFilledBuyPrice = null;
+    manager._lastFilledSellPrice = null;
+    if (wasArmed) {
+        try {
+            manager.logger?.log?.(`[LAST-FILL-GUARD] Pivot cleared (${reason}); guard re-arms on the next fill`, 'info');
+        }
+        catch { /* logging is best-effort */ }
+    }
+    return wasArmed;
+}
+/**
+ * Restore the persisted LAST-FILL-GUARD pivot into the manager.
+ *
+ * MUST run with the boundary (after loadGrid has applied the persisted
+ * genesis + re-typed the grid, before the first reconcile/broadcast) so the
+ * guard is never armed against a geometry the snapshot does not describe.
+ *
+ * Validation chain (fail → no-op, never arm on a poisoned value):
+ * 1. Shape: normalizeLastFillPivot re-validates the row (shared gate).
+ * 2. TTL: a pivot older than GRID_LIMITS.LAST_FILL_PIVOT_TTL_MS expires
+ *    instead of vetoing legitimate placements after long downtime (the
+ *    pivot is a "latest fill" fact, not a permanent ratchet). Expired rows
+ *    are dead rows: the shared drop path (clearPersistedLastFillPivot
+ *    under the bot's persistence lock, best-effort) erases them so a later
+ *    validation failure cannot leave a half-invalid row armed.
+ * 3. Genesis binding: a row whose genesisHash differs from the manager's
+ *    current genesis belongs to a dead generation — dropped through the
+ *    same shared drop path (erased from disk so it cannot re-arm on the
+ *    next restart).
+ * 4. On-grid check reuses the runtime's own ladder validator
+ *    (resolveOnGridPivot in dexbot_cow_runtime, safe to import from here —
+ *    utils/system never imports it otherwise, so no cycle). One
+ *    implementation for both the live guard and the restore path, same
+ *    increment fallback chain. On success the snapped ladder level is
+ *    restored — the guard's own convention — never the raw persisted
+ *    float, and the ORIGINAL fillsAt is preserved through
+ *    setLastFillPivot's atMs so the TTL keeps meaning "age of the last
+ *    fill", not "time since this restart".
+ *
+ * @param {Object} manager - OrderManager instance
+ * @param {Object|null} persisted - {price, type, fillsAt, genesisHash} from loadLastFillPivot
+ * @param {Object} [options]
+ * @param {number} [options.now] - Injectable clock (tests)
+ * @returns {boolean} True when the guard was re-armed from the snapshot
+ */
+export function restoreLastFillPivot(manager, persisted, options = {}) {
+    if (!manager || !persisted || typeof persisted !== 'object')
+        return false;
+    const row = normalizeLastFillPivot(persisted);
+    if (!row)
+        return false;
+    // Shared drop path for every "this row is dead" verdict: erase the
+    // persisted row best-effort so a rejected value can never re-arm the
+    // same rejection on the next restart (storeMasterGrid deliberately
+    // keeps untouched rows for legacy `undefined` callers, so without the
+    // erase the verdict has no TTL guarantee across restarts either).
+    const dropPersistedRow = () => {
+        try {
+            const acct = manager.accountOrders;
+            if (acct && typeof acct.clearPersistedLastFillPivot === 'function') {
+                void acct.clearPersistedLastFillPivot();
+            }
+        }
+        catch { /* best-effort */ }
+    };
+    // TTL first: an expired pivot is dropped, not re-armed.
+    const now = Number.isFinite(options?.now) ? Number(options.now) : Date.now();
+    if (now - row.fillsAt > Number(GRID_LIMITS.LAST_FILL_PIVOT_TTL_MS)) {
+        manager.logger?.log?.(`[LAST-FILL-GUARD] Persisted pivot expired (age ${Math.round((now - row.fillsAt) / 1000)}s > TTL ${Math.round(Number(GRID_LIMITS.LAST_FILL_PIVOT_TTL_MS) / 1000)}s) — guard re-arms on the next fill`, 'info');
+        dropPersistedRow();
+        return false;
+    }
+    // Genesis binding: a persisted pivot from another genesis is not valid
+    // after a regeneration/re-derive. Drop the row so it cannot resurrect,
+    // and let the startup book seed take over.
+    const liveHash = manager._genesis?.priceLevelsHash;
+    if (typeof liveHash !== 'string' || liveHash.length === 0 || liveHash !== row.genesisHash) {
+        manager.logger?.log?.(`[LAST-FILL-GUARD] Persisted pivot genesis mismatch (stored ${row.genesisHash} vs live ${liveHash ?? 'none'}) — dropping (grid regenerated); book seed will arm instead`, 'warn');
+        dropPersistedRow();
+        return false;
+    }
+    // On-grid validation through the runtime's own ladder validator — the
+    // exact same one-increment drift rule, snap, and off-grid refusal the
+    // live guard applies per probe. Import is safe: utils/system.ts does not
+    // otherwise import the cow runtime, and the runtime's own module top
+    // level already imports utils/system (sleep, then the pivot helpers),
+    // so this adds no new edge to the graph.
+    try {
+        const validated = cowRuntimeLadderValidator(manager, row.price);
+        if (!validated)
+            return false;
+        // Arm through the shared writer, preserving the persisted timestamp.
+        setLastFillPivot(manager, row.type, validated.price, 'fill', row.fillsAt);
+        manager.logger?.log?.(`[LAST-FILL-GUARD] Restored persisted pivot ${validated.price}(${row.type})` +
+            `${validated.slotIdx != null ? ` slot=${validated.slotIdx}` : ''}` +
+            `${validated.snapped ? ' (snapped)' : ''} age=${Math.round((now - row.fillsAt) / 1000)}s from snapshot`, 'info');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Retry grid persistence if previous attempt failed.
  * Clears persistence warning flag if successful.